[GitHub] nifi pull request #2944: [WIP] NIFI-5506 - support disabling wantClientAuth ...

[ruckc <gi...@git.apache.org>]

GitHub user ruckc opened a pull request:

    https://github.com/apache/nifi/pull/2944

    [WIP] NIFI-5506 - support disabling wantClientAuth for use behind reverse proxies

    Before merging need assistance wordsmithing the administration-guide.adoc file.  Specifically the below paragraph.
    
    > Similar to nifi.security.needClientAuth, the web server can be configured to require certificate based client authentication for users accessing the User Interface. In order to do this it must be configured to not support username/password authentication using Lightweight Directory Access Protocol (LDAP) or Kerberos. Either of these options will configure the web server to WANT certificate based client authentication. This will allow it to support users with certificates and those without that may be logging in with their credentials or those accessing anonymously. If username/password authentication and anonymous access are not configured, the web server will REQUIRE certificate based client authentication. See User Authentication for more details.

You can merge this pull request into a Git repository by running:

    $ git pull https://github.com/ruckc/nifi NIFI-5506

Alternatively you can review and apply these changes as the patch at:

    https://github.com/apache/nifi/pull/2944.patch

To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:

    This closes #2944
    
----
commit bf2982ab10871e43d7a5f5e8eb9d2006cd6bf280
Author: Curtis W Ruck <ru...@...>
Date:   2018-08-10T11:50:21Z

    NIFI-5506 - add additional property to allow disabling wantClientAuth when used with other credential providers

----


---

[GitHub] nifi issue #2944: [WIP] NIFI-5506 - support disabling wantClientAuth for use...

[joewitt <gi...@git.apache.org>]

Github user joewitt commented on the issue:

    https://github.com/apache/nifi/pull/2944
  
    On the PR:
    - Small things:
    1) The message has the wrong JIRA number
    2) The default of false is incorrect and should be true to remain consistent with current usage.
    
    Bigger concern:
    The design of NiFi security model as discussed in the previous discussion thread is important to consider here. Have you tested that a secure NiFi cluster, cluster replication, and site-to-site capabilities function in this configuration?  Can you elaborate on the testing conducted?  It is believed these would all break under this code change and configuration.
    
    We need to have a more formal feature related discussion on how to get from where we are to where we need to be to properly support this.  Your use case is a perfectly good one to support but to get there we cannot break what we do support today.



---

[GitHub] nifi issue #2944: [WIP] NIFI-5508 - support disabling wantClientAuth for use...

[ruckc <gi...@git.apache.org>]

Github user ruckc commented on the issue:

    https://github.com/apache/nifi/pull/2944
  
    So, i can try adjusting everything as needed, and close this PR and create a new one from a branch with the right name.
    
    On the actual details.  S2S doesn't work behind a reverse proxy currently.
    So, then the arguable right answer would be to support pulling certificates from a Reverse Proxy Request Header, and try to keep X509 Authentication working as it is currently.
    
    So S2S, this would only apply to HTTP S2S API.  I'm not very familiar with this, does the S2S HTTP API all in a certain context path i.e. /nifi-api/s2s?  If the UI never accesses that context path, then X509 Authentication only needs to be enabled on that path, not the entire server.  We should be able to do that by triggering an SSL/TLS renegotiation needing/wanting client authentication.



---